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claims 

A method of monitoring a plurality of local event logs 
of a computer network, the method comprising: 

entering the local event logs in a central database of 
the computer network, and 

sending the central database from the computer network 
to an external support computer system for analysis of 
the local event logs. 

The method of claim 1, wherein each local event log is 
generated for one particular node of the computer net- 
work, and storing the local event logs in --the cen- 
tral database using a corresponding node identifier as 
a key. 

The method of claim 1, the computer network comprising 
a server computer for storing the central database, 
the server computer having a local server event log, 
the method further comprising storing the local server 
event log in the central database, and sending the 
central database from the server computer of the com- 
puter network to the external support computer system. 

The method of claim 3 , further comprising entering an 
event into the local server event log after the cen- 
tral database has been sent to the external support 
computer system. 

The method of claim 1, wherein each event log entry in 
a local event log has an event identifier, a time 
stamp and event information descriptive of the event . 
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6. The method of claim 1, wherein the central database is 
stored on a seirver computer of the computer network, 
and further comprising the steps of: 

coupling program code from the server computer to net- 
work nodes of the computer network, and 

transferring the local event logs of the network nodes 
to the server computer by remotely executing the pro- 
gram code by the server computer on the network nodes . 

7 . A memory storing a computer program for causing a com- 
puter network to generate a central database for stor- 
ing local event logs of network nodes of the computer 
network, the computer program causing the computer 
network to perform the steps of : 

transmitting the respective local event logs from the 
network nodes to a server computer of the computer 
network, 

storing the local event logs in the central database 
on the server computer using the node identifiers of 
the network nodes as keys for the respective local 
event logs, and 

storing a local server event log of the server com- 
puter in the central database, the local server event 
log being adapted to store a send event after the cen- 
tral database has been sent to an external support 
computer system for analysis of the local event logs . 

8. The memory of claim 7, wherein the program causes the 
network to send the central database to the external 
support computer system at customisable periodic time 
inteirvals . 
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9. The memory of claim 1 , wherein the program includes 
program code for remote execution on the network nodes 
to cause the network nodes to send the respective lo- 
cal event logs to the server computer. 

10. A server computer system of a computer network having 
a plurality of network nodes, the server computer sys- 
tem comprising: 

a controller for causing the network nodes to transmit 
respective local event logs of the network nodes to 
the server computer system, 

a store for the local event logs in a central data- 
base, 

a transmitter for sending the central database to an 
external support computer system for analysis of the 
local event logs . 

11. The server computer system of claim 10, further com- 
prising a local server event log for storing an event 
in response to the central database being sent to the 
external support computer system, the send event hav- 
ing a time stamp. 

12. A discovery server comprising: 

a discovery program component for discovery of network 
nodes of a computer network, 

a remote execution program component for causing the 
network nodes to transmit respective local event logs 
to the discovery server. 
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a central database for storing the local event logs 
and for storing a local discovery server event log, 
and 

an interface component for sending the central data- 
base to the external support computer system for 
analysis of the local event logs . 

13. The discovery server of claim 12, wherein the local 
discovery server event log is adapted to store an 
event indicative of a transfer of the central database 
from the discovery server to the external support com- 
puter system. 

14. A method of monitoring a plurality of local event 
logs, the method comprising the steps of: 

receiving a database from a customer computer network, 
the database comprising the local event logs of net- 
work nodes of the computer network, 

querying the database to identify a database send 
event in the local event logs and its corresponding 
sent time stamp, 

querying the database to identify local event log en- 
tries having time stamps later than the sent time 
stamp . 

15 . The method of claim 14 , further comprising comparing 
the identified event log entries to rules of alert 
policies to determine whether an alert action should 
be invoked . 

16. The method of claim 15, further comprising sending an 
email message to a response center engineer as an 
alert action. 
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17. A memory storing a computer program for enabling a 
computer to monitor plural local event logs of a com- 
puter network, the computer program causing the com- 
puter to perform the steps of : 

storing a database associated with a customer computer 
network, the database comprising the local event logs 
of network nodes of the computer network, 

querying the database to identify a database send 
event in the local event logs and its corresponding 
sent time stamp, and 

querying the database to identify local event log en- 
tries having time stamps later than the sent time 
stamp. 

18. The memory of claim 17, wherein the program causes 
the computer to determine whether an alert action 
should be invoked by comparing the identified event 
log entries to rules of alert policies. 

19. The memory of claim 18, wherein the program causes the 
computer to send an automatic notification to a re- 
sponse center engineer if the determining step deter- 
mines an alert action should be invoked. 

20. The memory of claim 17, wherein the computer program 
causes the computer to receive from the customer com- 
puter network the database associated with the cus- 
tomer computer network. 

21. A support computer system for providing network sup- 
port services for a customer computer network, the 
support computer system comprising: 
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a memory for storing a database associated with the 
customer computer network, the database comprising lo- 
cal event logs of network nodes of the customer com- 
puter network, 

a database query component for querying the database 
to determine a database send event and its correspond- 
ing transfer time stamp in the database and for query- 
ing the database to identify event log entries having 
time stamps later than the sent time stamp, 

an analysis component for comparing the identified 
event log entries to the rules of alert policies to 
determine whether an alert action should be invoked. 

22. A system according to claim 21 wherein the memory is 
adapted to re-ceive from the customer's computer net- 
work the database associated with the customer com- 
puter network. 

23. A response center computer system for providing net- 
work support services for a plurality of customer com- 
puter networks, the response center computer system 
comprising : 

a memory for storing a database associated with the 
customer computer network, the database comprising lo- 
cal event logs of network nodes of the customer com- 
puter network, 

a database query component for querying the database 
to determine a database send event and its correspond- 
ing transfer time stamp in the database and for query- 
ing the database to identify event log entries having 
time stamps later than the sent time stamp. 
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an analysis component for comparing the identified 
event log entries with rules of alert policies to de- 
termine whether an alert action should be invoked, and 

an automatic notification component for sending an 
email message to a response center engineer in re- 
sponse to the analysis component determining that an 
alert action should be invoked. 

A system according to claim 23 wherein the memory is 
adapted to receive from the customer's computer net- 
work the database associated with the customer com- 
puter network. 



